undefined | Better HN

0 pointsKronisLV1y ago0 comments

> This raises an interesting question: should email addresses be private?

I sadly don't think that's viable.

What might be, in our current world, would be having a mail server/client setup where you can generate random addresses for yourself like Wf1JJUBHLu@domain.com and never re-use an e-mail address, much like with passwords, while being able to see all of the incoming mail in the same place and respond with the corresponding accounts.

Then, when your address gets traded around, it'd be fairly obvious (with some basic bookkeeping, e.g. a text field with purpose/URL for why a certain address was created) who is to blame for it and blocking incoming traffic from somewhere would be trivial as well.

I do have a self-hosted mail server and there are commands to create new accounts pretty easily, I'd just need to figure out the configuration for collecting everything in one place, as well as maybe make a web UI for automating some of the bits. I wonder if there are any off the shelf solutions for this out there.

0 comments

ddoeth1y ago

I also have my own mailserver and I don't create new accounts, I have a wildcard filter that drops all emails that come to my domain in my inbox. This is of course only viable when you are the only person using the domain, but I just sign up with a new mail address every time I sign up, for example my hackernews account would be hackernews-acc@xx.com That way I have a clear differentiator for every domain.

iam-TJ1y ago

I do something similar except that I do not allow wildcard reception - I create unique service-identifying user@ for each service I give an address to, and have a simple script that immediately adds that to the Postfix virtual table.

That way the SMTP server can reject all unknown user@ without accepting them in the first place - preventing spamming and some types of denial of service through resource starvation.

I also apply greylist based on a unique tuple (From, To, client IP address) so on first connection with that tuple valid SMTP clients need to re-deliver the email after a waiting period. Any subsequent delivers are accepted immediately.

KronisLVOP1y ago

That's a pretty cool approach! I'd only be worried about the risk of leaking the main account address when responding to anything, but it's probably doable with a bit of research, like Postfix catch-all setups seem straightforward enough.

climb_stealth1y ago

FWIW that should just be a matter of using the right configuration and mail client. With Fastmail for example I get to use a catch-all setup with my domain, and respond to whatever email it was sent to.

And the other way around as well. Send an email from an arbitrary <whatever>@domain email address.

EVa5I7bHFq9mnYK1y ago

Yes, but privacy suffers with this approach, because if one of emails ending in @domain.com is tied to your identity, all are.

KronisLVOP1y ago

That's not really my use case, but seems like an important concern for many!

At that point, you probably want to use whatever features one of the big providers use, like: https://proton.me/support/aliases-mail

Maybe even something that'd sit in front of a mail server that you yourself control, I wonder what the variety of options out there is.

Sebb7671y ago

This is true for someone manually searching for your info, but sufficient to fool spam lists and most data brokers. This really depends on your threat scenario.

j / k navigate · click thread line to collapse

0 pointsKronisLV1y ago0 comments

> This raises an interesting question: should email addresses be private?

I sadly don't think that's viable.

0 comments

ddoeth1y ago

iam-TJ1y ago

That way the SMTP server can reject all unknown user@ without accepting them in the first place - preventing spamming and some types of denial of service through resource starvation.

KronisLVOP1y ago

climb_stealth1y ago

And the other way around as well. Send an email from an arbitrary <whatever>@domain email address.

EVa5I7bHFq9mnYK1y ago

Yes, but privacy suffers with this approach, because if one of emails ending in @domain.com is tied to your identity, all are.

KronisLVOP1y ago

That's not really my use case, but seems like an important concern for many!

At that point, you probably want to use whatever features one of the big providers use, like: https://proton.me/support/aliases-mail

Maybe even something that'd sit in front of a mail server that you yourself control, I wonder what the variety of options out there is.

Sebb7671y ago

This is true for someone manually searching for your info, but sufficient to fool spam lists and most data brokers. This really depends on your threat scenario.

j / k navigate · click thread line to collapse